Splunk Search

Old Index Old Sourcetype New Field - Search Issues

hkchew
New Member

Hi all,

I have used back the old index & sourcetype but i have re-created new field names for my dashboard.
when using the dashboard, i will see the new fields but the rest of my team will see the old fields.
How can I resolve this? Please advise.
Thank you very much

Eg.
old index = "ABC"
old sourcetype = "DDD"
old fieldname = "DDD_XXX"

old index = "ABC"
old sourcetype = "DDD"
new fieldname = "DDD_YYY"

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@hkchew , have you set the permissions to the new fields so that others can see ?

Happy Splunking!
0 Karma

dkeck
Influencer

HI

could it be that you did not change the permissions of your new field extractions

Check them in Fields » Field extractions » Permissions

0 Karma

hkchew
New Member

Hi dkeck,

permissions have been set to "global".

0 Karma

dkeck
Influencer

Ok, please check if the users have a field extraction in their users folder for your sourcetype/source/host

/opt/splunk/etc/users/username/appname/local/props.conf

sometimes this could interfere with other extractions, when then refer to the same name or field.

Also check if you have these new extractions within your users folder, because then they have not been shared with others.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>